Risk management
Domain 5: Security Program Management & Oversight · Not started
Main exam topics
Governance, policies, standards and roles; risk assessment and treatment; vendor oversight; compliance and privacy; audits and assessments; security awareness; annualized loss expectancy = single loss expectancy × annual rate of occurrence.
SY0-701 topic overview · Independent study resource, not a prediction of exam questions.
Identifying and recording risk
Risk combines likelihood and impact. Risks are recorded in a risk register with owners, ratings, and treatment plans. Risk appetite is how much risk the organization is willing to pursue; risk tolerance is the acceptable variation around it. Key risk indicators warn when a risk is increasing.
Qualitative and quantitative
Qualitative analysis uses ratings such as high, medium, low. Quantitative analysis uses money. Single loss expectancy (SLE) equals asset value times exposure factor. Annualized rate of occurrence (ARO) is how often per year the event is expected. Annualized loss expectancy (ALE) equals SLE times ARO. A $200,000 asset with a 25% exposure factor has an SLE of $50,000; if it happens once every two years, ARO is 0.5 and ALE is $25,000.
Treatment
Mitigate by adding controls. Transfer through insurance or contracts. Avoid by stopping the risky activity. Accept when the cost of treatment exceeds the benefit, documented and approved by the risk owner. A control is usually justified when its annual cost is less than the reduction in ALE it provides. Residual risk is what remains after controls.
Business impact analysis
A BIA identifies critical functions and the impact of losing them, setting RTO and RPO values that drive continuity planning.
Know the difference: Risk treatment options
| Option | Action | Example |
|---|---|---|
| Mitigate | Reduce likelihood or impact | Add MFA |
| Transfer | Shift cost | Cyber insurance |
| Avoid | Stop the activity | Retire a risky app |
Saved